As the Company provides electronic transaction services on our official website (https://www.bangkokinsurance.com) and mobile application, the Company establishes this Privacy and Personal Data Management Policy to determine rules for collecting, retaining, using or disclosing personal data of service users to ensure security, safety and reliability in pursuant to the Notification of Office of Insurance Commission Re: Rules and methods for issuing and offering insurance policies, and paying compensation for claims according to insurance contracts through electronic channels B.E. 2560 and other relevant laws.

• 2.1 “The Company” or “BKI” means Bangkok Insurance Public Company Limited
• 2.2 “Personal data” means data about an individual that can be used to identify the individual either directly or indirectly. Personal data can be categorized into 2 types as follows:
  • 2.2.1 General personal data includes name, surname, gender, date of birth, age, status, address, occupation, workplace, telephone number, fax number, e-mail address or others that contain name of the individual or any identifying numbers, codes or other identifiers such as fingerprints, voiceprints, or photographs. This also includes information about the deceased persons.
  • 2.2.2 Sensitive personal data means data unique to an individual such as race, religion, education, financial status, health record, criminal record, professional profile, activity record or data that could result in harm to the individual’s reputation or may cause negative feelings of discrimination or unfair treatment. This also includes data unique to the deceased persons.
• 2.3 “Service user” means the owner of personal data who uses electronic transaction services on the Company’s official website (https://www.bangkokinsurance.com) and mobile application or any other electronic services of the Company.
• 2.4 “Personal data owner” means the person owning the data, his/her legal representative, guardian, or curator, and also includes his/her spouse and statutory heir, or the beneficiary as specified in the insurance policy in the case where the data owner deceases.

The Company may obtain your personal data for certain business purposes, and the Company is ready and willing to provide supporting reasons upon your request.

For details of collected information, please refer to Item 6.

3.1 To ensure thesecurity, safety and reliability of the Company’s electronic transactions and to establish the personal data protection measures in compliance with requirements of the laws.

4.1 This Policy shall be applicable to the Company’s employees and vendors or outsourcing service providers having access to personal data.

The Company obtains personal data of service users by lawful and fair means. The Company will collect only information necessary for carrying out electronic transactions in accordance with the Company’s purpose of operation and as required by laws. Consent will be obtained from service users on the Company’s website or through the Company’s mobile application or any other electronic means prior to the collection except for the purpose of fulfilling legal requirements or in the cases specified in this Policy. In any case, the Company will maintain confidentiality of the data.

• The Company collects and stores personal data of service users for the purpose of carrying out the Company’s tasks which are in accordance with the authority, duties and purposes of operation of the Company. The Company attaches importance to accuracy and completeness of data and ensures that the data is always up-to-date.

• The Company collects, retains, uses or discloses personal data of service users for the following purposes:
• 7.1 For convenience of using the Company’s services
• 7.2 For membership application or use of any electronic transactions provided by the Company
• 7.3 For service usage survey for the purpose of the Company’s service improvement
• 7.4 For business operations as per the Company’s objectives announced on the Company’s official website
• 7.5 For compliance with laws, rules, regulations or instructions which are requirements for the Company’s business operations

Should there be any changes to the aforesaid purposes of personal data collection, the Company will inform service users of the changes, make an online request for consent of service users, and make relevant announcements on the Company’s official website (https://www.bangkokinsurance.com) and mobile application as well as at the Company’s Head Office and branches nationwide at least 30 days in advance. In this connection, any adjustments or additions will be recorded as evidence.

• The Company shall not disclose or display the data or make the data available in any other ways that are not in accordance with the purposes of personal data collection unless written consent is given by personal data owners in the form of letter of consent for information disclosure or the Company is required by laws or court orders to disclose personal data.

• The Company appoints IT Security Committee to be in charge of IT risk management, establish IT security policies, and implement various risk control measures in compliance with ISO/IEC 27001:2013 as well as create data security conscious environment that all the Company’s employees strictly comply with the policies and protect the data from loss and damage as well as unauthorized access, use, modification or disclosure.

• The Company shall disclose the Privacy and Personal Data Management Policy and Guidelines to service users and announce any revisions thereto on the Company’s official website (https://www.bangkokinsurance.com) or mobile application and at the Company’s offices nationwide. In cases where service users wish to check existence and nature of personal data, purposes and use of the information, service users may request to do so at the Company’s offices nationwide.

• The Company shall disclose details of personal data upon the owner’s request provided that the request form be filled in and purposes of use be provided at the Company’s offices nationwide. The request will be completely processed within 30 days as set forth in this Policy. In cases where the personal data owner objects to the retention or accuracy of the data, or undertakes any actions such as notification of updates or deletion of the data, the Company will consider taking appropriate actions and record the objection as evidence.

• 12.1 The Company will only use the personal data of service users as is necessary and in accordance with the purposes of data collection and retention as set forth in the Company’s Privacy and Personal Data Management Policy.
• 12.2 The Company assures that the collected personal data of service users will not be disclosed, displayed or made available in any other ways that are not in accordance with the purposes of personal data collection unless written consent is given by personal data owners in the form of letter of consent for information disclosure or the Company is allowed by the laws to disclose the information.
• 12.3 In cases where the Company outsources to other entities the tasks that involve personal data of service users such as parcel delivery, statistical analysis on the Company’s businesses or activities, the Company shall require that the outsourced entities maintain confidentiality and security of the personal data and prohibit any use of the personal data unless for the purposes of the Company’s activities or businesses.
• 12.4 Relevant staff of the Company shall strictly comply with the Privacy and Personal Data Management Policy and Guidelines as announced by the Company. Staff breaching or failing to comply with this Policy shall be subject to punishment in accordance with the Company’s regulations.

• The Company displays personal data linkage to other entities in order to execute electronic transactions of service users such as payment by direct debit, etc. Personal data of service users both in the form of document or electronic data are kept confidential including during transmission of data. The Company requires all relevant officers strictly comply with the Company’s Privacy and Personal Data Management Policy and Guidelines.

• The Company combines personal data of service users obtained through the Company’s website or mobile application and from documents with the data obtained from agency/brokerage companies and banks that serve as the Company’s insurance agents. The Company requires that all relevant officers strictly comply with the Company’s Privacy and Personal Data Management Policy and Guidelines.

• The Company shall not disclose stored personal data to other irrelevant persons or entities unless consent is given by personal data owners or disclosure is required by laws.

• The Company shall collect, classify and use personal data of service users in accordance with the objectives as set forth by the Company.
• 16.1 Use of cookies: The Company’s website uses cookies that link to personal data to enhance convenience in using the website. The data recorded or stored by “cookies” will be used in statistical analysis or other activities to further improve the Company’s services.
• 16.2 Collection of demographic information: The Company’s website (https://www.bangkokinsurance.com) or mobile application collects demographic statistics that can be linked to personally identifiable information for the purpose of usage survey that will be used to enhance the Company’s service quality.
• 16.3 Log files: The Company’s website automatically keeps logs of user access and service usage that can be linked to personally identifiable information as evidence for future examination of user’s activities on the website (https://bangkokinsurance.com) or mobile application in accordance with the Computer-Related Crime Act B.E. 2560.
• 16.4 “Optional” provision of information: The Company provides electronic services through our website or mobile application where service users are requested to provide information in 2 field types, i.e. mandatory fields in which service users are required to provide data necessary for processing the desired services, and optional fields in which service users can choose to provide data. In cases where service users do not wish to provide data via website, they may provide the data to the company directly.

• The Company shall review and revise the Privacy and Personal Data Management Policy on a regular basis to ensure that the Policy is always up-to-date and follows a standard format. It is highly recommended that service users study the Privacy and Personal Data Management Policy upon their visit to or use of service on the Company’s website (https://www.bangkokinsurance.com) or mobile application.

• The Company shall not use personal data of service users for purposes other than those specified in the Privacy and Personal Data Management Policy. However, should it be necessary to use the personal data for other undertakings, the Company shall contact the information owners to obtain their prior consent.

• The Company shall retain personal data of service users only for a period necessary for carrying out the tasks as per the purposes specified in this Policy. In cases where information owners wish to revoke their consent to personal data retention, they may express their intention at the Head Office, Bangkok Insurance Building. The Company shall consider taking appropriate actions and record the expressed intention as evidence.

• 20.1 It is recommended that service users also examine privacy and personal data management policies of third party websites to which the Company’s website contains links in order to understand how those third party websites collect, store, use or disclose personal data. The Company is unable to certify the contents or guarantee any actions as announced on those third party websites. Also, the Company assumes no liability in the event that those third party websites fail to proceed or take any actions as announced in their privacy and personal data management policies.
• 20.2 The Company assumes no liability for any damage incurred if service users disclose their personal data to any third parties or fail to properly log off the system after each visit or take actions without paying attention to information security.

• Should you have any questions, suggestions or comments regarding the Privacy and Personal Data Management Policy or compliance with the Policy, the Company is willing to answer all your inquiries, and listen to your suggestions and comments that will be beneficial to our service improvement. Please contact us at the following address:

• Head Office, Bangkok Insurance Building
  25 Sathon Tai Road, Thung Maha Mek, Sathon, Bangkok 10120
  Telephone : 0 2285 8888
  Fax : 0 2610 2100
  Website: https://www.bangkokinsurance.com